Skip to content

Password Reused

URI: https://docs.ankatech.co/errors/password-reused
HTTP Status: 400 Bad Request

When you see this

A password reset was rejected because the new password violates the reuse policy — it is one the account has used before. Emitted by ankasecure-auth-api on the password-reset endpoint. It is the only reset-only failure that is a password-policy problem rather than a token problem.

Common Causes

  • The chosen password matches one held in the account's password history.

Response Example

{
  "type": "https://docs.ankatech.co/errors/password-reused",
  "title": "Password Reused",
  "status": 400,
  "detail": "The new password was used previously. Please choose a different password.",
  "instance": "/api/v3/auth/account/password/reset",
  "timestamp": 1730000000
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

The type is deliberately distinct from every token type so a client renders "choose a different password" rather than "this link is invalid". It is reachable only with a validly-signed reset token, so it discloses no account existence.

How to Resolve

  1. Choose a password the account has not used before.
  2. Re-submit the reset with the same link — the token is still valid; only the password was refused.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.